


global _main

section .data
LC0:
	db "%s Error[%d]",0ah,0
	
LC1:
	db "ERROR",0
	
LC2:
	db "CreateToolhelp32Snapshot",0
	
LC3:
	db "new",0
	
LC4:
	db "OpenProcess",0
	
LC5:
	db "VirtualAllocEx",0
	
LC6:
	db "WriteProcessMemory",0
	
LC7:
	db "kernel32.dll",0
	
LC8:
	db "LoadLibraryA",0
	
LC9:
	db "GetProcessAddress",0
	
LC10:
	db "explorer.exe",0
	
LC11:
	db "C:\\Users\\a\\nasm_work\\proj2\\a4.dll",0
	
LC12:
	db "apc inject ok.",0ah,0
	
LC13:
	db "apc inject error.",0ah,0
	
LC14:
	db "stack check fail!",0ah,0

extern _printf,_wsprintfW,_MessageBoxA,_exit,_memset,_CreateToolhelp32Snapshot,_Process32First,\
_lstrcmpi,_Process32Next,_malloc,_Thread32First,_Thread32Next,_free,_lstrlen,_OpenProcess,\
 _VirtualAllocEx, _WriteProcessMemory,_GetModuleHandleW,_GetProcAddress,_OpenThread,_QueueUserAPC,\
 _CloseHandle,_GetLastError,_GetModuleHandleA
section .text 
_main:
	push ebp
	mov ebp,esp
	sub esp,0x1000
	
	mov dword [ebp-4], 0 ; bRet 
	
	mov esi,esp 
	push LC11 
	push LC10
	call _ApcInjectDll 
	add esp,8
	cmp esi,esp
	call _cs 
	mov [ebp-4], eax ; bRet
	
	mov eax,[ebp-4] ; bRet
	test eax,eax
	je .Lmain_400
	
	mov esi,esp 
	push LC12 
	mov eax,0 
	call _printf 
	add esp,4
	cmp esi,esp
	call _cs 

	jmp .Lmain_0
	
.Lmain_400:
	mov esi,esp 
	push LC13 
	mov eax,0
	call _printf
	add esp,4
	cmp esi,esp
	call _cs 

.Lmain_0:
	mov eax,0
	leave
	ret	 
	
	
_ShowError:
	push ebp
	mov ebp,esp
	sub esp,0x1000
	
	push ebx
	push esi
	push edi 
	
	; [ebp+8] pszText 
	
	mov dword [ebp-260],0 ; szErr 
	
	mov esi,esp 
	
	mov eax,[ebp+8] ;pszText
	push eax 
	push LC0 
	lea eax,[ebp-260] ; szErr
	push eax 
	call _wsprintfW 
	add esp,16
	cmp esi,esp
	call _cs 
	
	
	mov esi,esp 
	mov eax,0
	or eax,16
	push eax 
	push LC1
	lea eax,[ebp-260] ; szErr
	push eax 
	push 0
	call _MessageBoxA 
	add esp,16
	cmp esi,esp
	call _cs 
	
	mov eax,0
	pop edi
	pop esi
	pop ebx 
	add esp,0x1000 
	leave
	ret	 
	
_cs:		
	je .Lcs_0
	
	push LC14
	mov eax,0
	call _printf 
	
	push 0
	call _exit 	
	
.Lcs_0:	
	ret 
	

GetProcessIdByProcessName:
	push ebp
	mov ebp,esp
	sub esp,0x1000
	push ebx
	push esi
	push edi 	
	
	; [ebp+8] pszProcessName
	
	mov dword [ebp-4],0 ; dwProcessId
	mov dword [ebp-560],0 ; pe32
	mov dword [ebp-564],0 ; hSnapshot
	mov dword [ebp-568],0 ; bRet
	
	mov esi,esp 
	push 556
	push 0 
	lea eax,[ebp-560] ; pe32
	push eax 
	call _memset
	add esp,12
	cmp esi,esp 
	call _cs 
	
	lea edi, [ebp-560] ; pe32 
	mov dword [edi],556 ; pe32.dwSize
	
	mov esi,esp 
	push 0
	push 2
	call _CreateToolhelp32Snapshot
	mov [ebp-564],eax ; hSnapshot	
	cmp esi,esp
	call _cs 
		
	cmp dword [ebp-564], 0 ; hSnapshot
	jne .LGetProcessIdByProcessName_400
	
	mov esi,esp
	push LC2 
	call _ShowError
	add esp,4
	cmp esi,esp
	call _cs 
	
	mov eax,[ebp-4] ; dwProcessId
	jmp .LGetProcessIdByProcessName_0	
	
.LGetProcessIdByProcessName_400:
	
	mov esi,esp
	lea eax,[ebp-560] ; pe32
	push eax 
	mov eax,[ebp-564] ; hSnapshot
	push eax 
	call _Process32First
	mov [ebp-568],eax ; bRet	
	cmp esi,esp
	call _cs 
	
	jmp .LGetProcessIdByProcessName_380
	
.LGetProcessIdByProcessName_399:
	mov esi,esp 	
	mov eax,[ebp+8] ; pszProcessName
	push eax 
	lea edi,[ebp-560] ;pe32
	lea eax,[edi+36] ; pe32.szExeFile
	push eax 	
	call _lstrcmpi 	
	cmp esi,esp
	call _cs
	
	cmp eax,0
	jne .LGetProcessIdByProcessName_390
	
	lea edi,[ebp-560] ;pe32
	mov eax,[edi+8] ; pe32.th32ProcessID
	mov [ebp-4],eax ; dwProcessId
	
	jmp .LGetProcessIdByProcessName_370
	
.LGetProcessIdByProcessName_390:
	mov esi,esp
	lea eax,[ebp-560] ;pe32
	push eax 
	mov eax,[ebp-564] ; hSnapshot
	push eax 
	call _Process32Next 	
	cmp esi,esp
	call _cs
	mov [ebp-568],eax ; bRet	
	
.LGetProcessIdByProcessName_380:
	mov eax,[ebp-568] ; bRet
	test eax,eax
	jne .LGetProcessIdByProcessName_399
	
.LGetProcessIdByProcessName_370:	
	mov eax,[ebp-4] ; dwProcessId
	
.LGetProcessIdByProcessName_0:
	pop edi
	pop esi
	pop ebx 
	add esp,0x1000
	leave
	ret 
	
	
_GetAllThreadIdByProcessId:
	push ebp
	mov ebp,esp
	sub esp,0x1000
	
	push ebx
	push esi
	push edi
	; [ebp+8] dwProcessId
	; [ebp+12] ppThreadId
	; [ebp+16] pdwThreadIdLength
	
	mov dword [ebp-4],0 ; pThreadId
	mov dword [ebp-8],0 ; dwThreadIdLength
	mov dword [ebp-12], 1000 ; dwBufferLength
	mov dword [ebp-40], 0 ; te32
	mov dword [ebp-44], 0 ; hSnapshot
	mov dword [ebp-48], 0 ; bRet
	

	mov esi,esp 
	mov eax,[ebp-12] ; dwBufferLength
	sal eax,2
	push eax 
	call _malloc
	add esp,4
	cmp esi,esp
	call _cs 
	mov [ebp-4],eax ; pThreadId
	
	cmp dword [ebp-4], 0 ;pThreadId
	jne .LGetAllThreadIdByProcessId_490
	
	mov esi,esp 
	push LC3 
	call _ShowError
	add esp,4
	cmp esi,esp
	call _cs 
	mov dword [ebp-48],0 ; bRet
	jmp .LGetAllThreadIdByProcessId_300 
	
.LGetAllThreadIdByProcessId_490:
	mov esi,esp 
	mov eax,[ebp-12] ; dwBufferLength
	sal eax,2
	push eax 
	push 0
	mov eax,[ebp-4] ; pThreadId
	push eax 
	call _memset
	add esp,12
	cmp esi,esp
	call _cs 
	
	mov esi,esp 
	push 28
	push 0
	lea eax,[ebp-40] ; te32
	push eax 
	call _memset
	add esp,12
	cmp esi,esp
	call _cs
	
	lea edi,[ebp-40] ; te32
	mov dword [edi+0],28 ; te32.dwSize 
	
	mov esi,esp 
	push 0
	push 4
	call _CreateToolhelp32Snapshot 	
	cmp esi,esp
	call _cs 
	mov [ebp-44],eax ; hSnapshot
	
	cmp dword [ebp-44], 0 ; hSnapshot
	jne .LGetAllThreadIdByProcessId_480
	
	mov esi,esp 
	push LC2 
	call _ShowError
	add esp,4
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-48], 0 ; bRet
	jmp .LGetAllThreadIdByProcessId_300  ;break
	
.LGetAllThreadIdByProcessId_480:
	mov esi,esp 
	lea eax,[ebp-40] ; te32
	push eax 
	mov eax,[ebp-44] ; hSnapshot
	push eax 
	call _Thread32First 	
	cmp esi,esp
	call _cs
	mov [ebp-48],eax ; bRet
	
	jmp .LGetAllThreadIdByProcessId_450
	
.LGetAllThreadIdByProcessId_479:
	lea edi,[ebp-40] ; te32
	mov eax,[edi+12] ; te32.th32OwnerProcessID
	cmp [ebp+8],eax ; dwProcessId
	jne .LGetAllThreadIdByProcessId_470
		
	lea edi,[ebp-40] ;te32
	mov ecx,[edi+8] ; te32.th32ThreadID
	
	mov eax,[ebp-8] ; dwThreadIdLength
	sal eax,2 
	mov edi,[ebp-4] ; pThreadId
	mov [edi+eax],ecx  ; pThreadId[dwThreadIdLength]
	
	add dword [ebp-8], 1 ; dwThreadIdLength
	
.LGetAllThreadIdByProcessId_470:
	mov esi,esp 
	lea eax,[ebp-40] ; te32
	push eax 
	mov eax,[ebp-44] ; hSnapshot
	push eax 
	call _Thread32Next	
	cmp esi,esp
	call _cs
	mov [ebp-48],eax ; bRet	
	
.LGetAllThreadIdByProcessId_450:
	mov eax, [ebp-48] ; bRet
	test eax,eax 
	jne .LGetAllThreadIdByProcessId_479
	
	mov ecx,[ebp-4] ; pThreadId
	
	mov eax,[ebp+12] ; ppThreadId
	mov [eax],ecx 
	
	mov ecx,[ebp-8] ; dwThreadIdLength
	
	mov eax,[ebp+16] ; pdwThreadIdLength
	mov [eax],ecx 
	
	mov dword [ebp-48], 1 ; bRet
	
.LGetAllThreadIdByProcessId_300:
	cmp dword [ebp-48], 0  ;bRet
	jne .LGetAllThreadIdByProcessId_0
	
	mov eax,[ebp-4] ; pThreadId
	test eax,eax
	je .LGetAllThreadIdByProcessId_0
	
	mov esi,esp 
	mov eax,[ebp-4] ; pThreadId
	push eax 
	call _free 
	add esp,4
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-4], 0 ; pThreadId
	
.LGetAllThreadIdByProcessId_0:
	mov eax,[ebp-48] ; bRet
	pop edi
	pop esi
	pop ebx
	add esp,0x1000
	leave
	ret 
	
	
_ApcInjectDll:
	push ebp
	mov ebp,esp
	sub esp,0x1000
	
	push ebx
	push esi
	push edi
	
	; [ebp+8]  pszProcessName
	; [ebp+12] pszDllName 
	
	mov dword [ebp-4], 0 ; bRet
	mov dword [ebp-8], 0 ; dwProcessId
	mov dword [ebp-12], 0 ; pThreadId
	mov dword [ebp-16], 0 ; dwThreadIdLength
	mov dword [ebp-20], 0 ; hProcess 
	mov dword [ebp-24], 0 ; hThread
	mov dword [ebp-28], 0 ; pBaseAddress 
	mov dword [ebp-32], 0 ; pLoadLibraryFunc
	mov dword [ebp-36], 0 ; dwRet
	mov dword [ebp-40], 0 ; dwDllPathLen 
	mov dword [ebp-44], 0 ; i 
	
	mov esi,esp 
	mov eax,[ebp+12] ; pszDllName
	push eax 
	call _lstrlen 
;	add esp,4
	cmp esi,esp
	call _cs 
	
	add eax,1
	mov [ebp-40],eax ; dwDllPathLen
	
	mov esi,esp 
	mov eax, [ebp+8] ; pszProcessName
	push eax 
	call GetProcessIdByProcessName
	add esp,4 
	cmp esi,esp
	call _cs 
	mov [ebp-8],eax ; dwProcessId
	
	cmp dword [ebp-8],0 ; dwProcessId
	jg .LApcInjectDll_400
	
	mov dword [ebp-4], 0 ; bRet
	jmp .LApcInjectDll_20
	
.LApcInjectDll_400:
	mov esi,esp 
	lea eax,[ebp-16] ; dwThreadIdLength
	push eax 
	lea eax,[ebp-12] ; pThreadId
	push eax 
	mov eax,[ebp-8] ; dwProcessId
	push eax 
	call _GetAllThreadIdByProcessId
	add esp,12
	cmp esi,esp
	call _cs 
	mov [ebp-4],eax ; bRet 
	
	cmp dword [ebp-4], 0 ; bRet
	jne .LApcInjectDll_390
	
	mov dword [ebp-4], 0 ; bRet
	jmp .LApcInjectDll_20
	
.LApcInjectDll_390:
	mov esi,esp 
	mov eax,[ebp-8] ; dwProcessId
	push eax 
	push 0 
	push 2097151 
	call _OpenProcess 	
	cmp esi,esp
	call _cs 
	mov [ebp-20], eax ; hProcess
	
	cmp dword [ebp-20], 0 ; hProcess
	jne .LApcInjectDll_380
	
	mov esi,esp 
	push LC4
	call _ShowError
	add esp,4
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-4], 0 ; bRet
	jmp .LApcInjectDll_20	
	
.LApcInjectDll_380:
	mov esi,esp 
	push 0x40 
	mov eax,0x1000 
	or eax,0x2000 
	push eax 
	mov eax,[ebp-40] ; dwDllPathLen
	push eax 
	push 0 
	mov eax,[ebp-20] ; hProcess
	push eax 
	call _VirtualAllocEx	
	cmp esi,esp
	call _cs 
	mov [ebp-28],eax ; pBaseAddress
	
	cmp dword [ebp-28], 0 ; pBaseAddress
	jne .LApcInjectDll_370
	
	mov esi,esp 
	push LC5 
	call _ShowError
	add esp,4
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-4], 0 
	jmp .LApcInjectDll_20
	
.LApcInjectDll_370:
	mov esi,esp 
	lea eax,[ebp-36] ; dwRet
	push eax 
	mov eax,[ebp-40] ; dwDllPathLen
	push eax 
	mov eax,[ebp+12] ; pszDllName
	push eax 
	mov eax,[ebp-28] ; pBaseAddress
	push eax 
	mov eax,[ebp-20] ; hProcess
	push eax 
	call _WriteProcessMemory	
	cmp esi,esp
	call _cs
	
	mov eax,[ebp-36] ; dwRet
	cmp eax,[ebp-40] ; dwDllPathLen
	je .LApcInjectDll_360
	
	mov esi,esp 
	push LC6
	call _ShowError
	add esp,4
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-4], 0 ; bRet
	jmp .LApcInjectDll_20
	
.LApcInjectDll_360:
	mov esi,esp 
	push LC7 
	call _GetModuleHandleA 	
	cmp esi,esp
	call _cs 	
	
	mov esi,esp 
	push LC8 
	push eax 
	call _GetProcAddress 	
	cmp esi,esp
	call _cs
	mov [ebp-32], eax ; pLoadLibraryFunc
	
	cmp dword [ebp-32], 0
	jne .LApcInjectDll_350
	
	mov esi,esp 
	push LC9 
	call _ShowError
	add esp, 4
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-4], 0 ; bRet
	jmp .LApcInjectDll_20
		
.LApcInjectDll_350:
	mov dword [ebp-44], 0 ; i 
	jmp .LApcInjectDll_300
	
.LApcInjectDll_349:
	mov esi,esp 
	mov eax,[ebp-44] ; i 
	sal eax,2
	mov edi, [ebp-12] ; pThreadId
	mov eax, [edi+eax] ; pThreadId[i]
	push eax 
	push 0
	push 2097151
	call _OpenThread 	
	cmp esi,esp
	call _cs
	
	mov [ebp-24], eax ; hThread
	
	mov eax,[ebp-24] ; hThread
	test eax,eax
	je .LApcInjectDll_310
	
	mov esi,esp 
	mov eax,[ebp-28] ; pBaseAddress
	push eax 
	mov eax,[ebp-24] ; hThread
	push eax 
	mov eax,[ebp-32] ; pLoadLibraryFunc
	push eax 
	call _QueueUserAPC 	
	cmp esi,esp
	call _cs 	
	
	mov esi,esp 
	mov eax,[ebp-24] ; hThread
	push eax 
	call _CloseHandle 	
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-24], 0 ; hThread
	
.LApcInjectDll_310:
	add dword [ebp-44], 1 ; i 
	
.LApcInjectDll_300:
	mov eax,[ebp-44] ; i 
	cmp eax,[ebp-16] ; dwThreadIdLength
	jl .LApcInjectDll_349
	
	mov dword [ebp-4], 1 ; bRet 
	
.LApcInjectDll_20:	

	mov eax,[ebp-20] ; hProcess
	test eax,eax
	je .LApcInjectDll_18
	
	mov esi,esp 
	mov eax, [ebp-20] ; hProcess
	push eax 
	call _CloseHandle	
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-20], 0 ; hProcess
	
.LApcInjectDll_18:
	mov eax,[ebp-12] ; pThreadId
	test eax,eax
	je .LApcInjectDll_1 
	
	mov esi,esp 
	mov eax,[ebp-12] ; pThreadId
	call _free 	
	cmp esi,esp
	call _cs 
	
	mov dword [ebp-12], 0 ; pThreadId 
	
.LApcInjectDll_1:
	mov eax,[ebp-4] ; bRet 
	pop edi
	pop esi
	pop ebx 
	add esp,0x1000
	leave
	ret 